Skip to content
skopnix
Detections · Rule
← IBM QRadar detectionsIBM QRadar · Behaviour (ATT&CK technique)

Shadow copy or backup catalog deletion (T1490)

AQLhighconfidence 85/100generated 2026-10-18

Deletion of Volume Shadow Copies or the Windows backup catalog, or disabling boot recovery — a step ransomware operators take right before encryption. Observed for: blackbyte, Medusa Group, Sandworm, Scattered Spider, Storm-0501, Void Manticore and 1 more.

ATT&CK
T1490 mitre ↗
Linked actors
blackbyte · Medusa Group · Sandworm · Scattered Spider · Storm-0501 · Void Manticore · WIZARD SPIDER
False positives
Each branch needs both the binary and the destructive verb (delete shadows / shadowcopy delete / recoveryenabled no / delete catalog); listing or creating shadow copies does not match.

AQL search

skopnix-qradar-ttp-t1490-968cb1e6.aqldownload .aql ↓
SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"
FROM events
WHERE ("Process Name" ILIKE 'vssadmin.exe' AND "Process CommandLine" ILIKE '%delete%' AND "Process CommandLine" ILIKE '%shadows%') OR ("Process Name" ILIKE 'wmic.exe' AND "Process CommandLine" ILIKE '%shadowcopy%' AND "Process CommandLine" ILIKE '%delete%') OR ("Process Name" ILIKE 'bcdedit.exe' AND "Process CommandLine" ILIKE '%recoveryenabled%' AND "Process CommandLine" ILIKE '%no%') OR ("Process Name" ILIKE 'wbadmin.exe' AND "Process CommandLine" ILIKE '%delete%' AND "Process CommandLine" ILIKE '%catalog%')
LAST 7 DAYS

CRE rule (build in Offenses > Rules)

download .txt ↓
Rule name: "Skopnix: Shadow copy or backup catalog deletion (T1490)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: ("Process Name" ILIKE 'vssadmin.exe' AND "Process CommandLine" ILIKE '%delete%' AND "Process CommandLine" ILIKE '%shadows%') OR ("Process Name" ILIKE 'wmic.exe' AND "Process CommandLine" ILIKE '%shadowcopy%' AND "Process CommandLine" ILIKE '%delete%') OR ("Process Name" ILIKE 'bcdedit.exe' AND "Process CommandLine" ILIKE '%recoveryenabled%' AND "Process CommandLine" ILIKE '%no%') OR ("Process Name" ILIKE 'wbadmin.exe' AND "Process CommandLine" ILIKE '%delete%' AND "Process CommandLine" ILIKE '%catalog%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1490".
FP-safety: Each branch needs both the binary and the destructive verb (delete shadows / shadowcopy delete / recoveryenabled no / delete catalog); listing or creating shadow copies does not match.

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References